Success strategies for security awareness

"We produce a weekly email newsletter, called NewsSource," said Shivanandan. "This vehicle can also be used for news flashes at any time. We also develop a bimonthly newsletter, available in print and online, and distribute to all employees. In addition, we use our BellSouth Television Network to stream messages to employees on TV monitors located in most BellSouth buildings." BellSouth also utilises its intricate voice mail system for emergency announcements to employees via telephone. And, depending on the initiative, they use printed posters, ID badge stickers, and key chain affinity cards.

"An example of an awareness initiative that we are currently running is a campaign that involves multiple employee communications vehicles, designed to encourage employees to run a monthly scan to ensure that all computers within the BellSouth environment are protected from Internet-based security threats."

Think fun
West said that another way to make sure your awareness initiatives reach everyone in the organisation, call their attention, and elicit cooperation, is to make security a "fun" topic. "Many people are scared of security in general and security professionals in specific. Take the scary aspect away by showing how they are a part of security and get them involved." West suggested setting up a special email or hotline where the employees can report suspicious activity.

"One possible consideration is the use of interactive games or well-placed humour," said Hansen. "A spoonful of sugar helps the security message go down."

Tell it like it is
"Also, I think it's important to explain WHY a given policy is in place," Hansen added. "Many people are rebellious by nature. If you say don't touch that red button, too many of us will do just that. By explaining that the red button will shut down power and cause millions in collateral damage, we are less likely to push the red button."

Sign off on the same page
"A written policy that staff have to sign speaks volumes," stressed West. "This protects you from frivolous lawsuits, and it protects the staff from the 'I-didn't-know-we-shouldn't-do-this' syndrome." The key to any security initiative is for everyone to be operating from the same page, she said.

According to West, the IT manager should not forget to put everything in writing, issue a copy to all staff, have them sign an acknowledgment form, and keep the forms with human resources as a matter of record.

Walk your talk
Another important tip came from West: remain visible and act swiftly. "It's hard for people to respect people/policies that they can't see in action," she said. "If staff sees that security is on the case, they will realise there is no room for error and that cooperation is mandatory. If your written policy says that any employee caught downloading inappropriate material will be terminated, you'd better be able to walk the talk."

In a nutshell
Shivanandan wrapped up an effective security-awareness strategy in a quick rundown: "First, develop a comprehensive communications plan for each initiative. Use multiple, appropriate communications vehicles to blanket the organisation and ensure that the majority of employees, a) receive the message; and b) receive it in a vehicle or manner that they will respond to. Initiatives should be endorsed at the officer level, with the message cascading throughout the organisation. The message should be direct, concise, and meaningful, and the call-to-action must be clear. Managers are engaged and assist with garnering attention and support."